Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 834454 (CVE-2022-25050, CVE-2022-25051) - <net-wireless/rtl_433-21.12: multiple vulnerabilities
Summary: <net-wireless/rtl_433-21.12: multiple vulnerabilities
Status: RESOLVED FIXED
Alias: CVE-2022-25050, CVE-2022-25051
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL: https://github.com/merbanan/rtl_433/i...
Whiteboard: ~3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2022-03-02 02:14 UTC by John Helmert III
Modified: 2022-03-19 05:20 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-03-02 02:14:24 UTC
CVE-2022-25050:

rtl_433 21.12 was discovered to contain a stack overflow in the function somfy_iohc_decode(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.

CVE-2022-25051:

An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12 when decoding a crafted file.

Patch: https://github.com/merbanan/rtl_433/commit/2dad7b9fc67a1d0bfbe520fbd821678b8f8cc7a8
Comment 1 Larry the Git Cow gentoo-dev 2022-03-16 20:54:31 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=048b1381de72db7437e5c7643bb2c72fa56cc930

commit 048b1381de72db7437e5c7643bb2c72fa56cc930
Author:     Rick Farina <zerochaos@gentoo.org>
AuthorDate: 2022-03-16 20:53:38 +0000
Commit:     Rick Farina <zerochaos@gentoo.org>
CommitDate: 2022-03-16 20:54:29 +0000

    net-wireless/rtl_433: add CVE fix patch to 21.12
    
    Bug: https://bugs.gentoo.org/834454
    Signed-off-by: Rick Farina <zerochaos@gentoo.org>

 net-wireless/rtl_433/files/rtl_433-21.12-CVE.patch | 55 ++++++++++++++++++++++
 net-wireless/rtl_433/rtl_433-21.12.ebuild          |  4 ++
 2 files changed, 59 insertions(+)
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-03-19 05:20:59 UTC
Thanks, all done!